VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 3, 2019· Updated Dec 3, 2025

CVE-2018-14468

CVE-2018-14468

Description

A buffer over-read in tcpdump's FRF.16 parser (mfr_print) before 4.9.3 allows remote attackers to cause a denial of service or possibly execute arbitrary code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A buffer over-read in tcpdump's FRF.16 parser (mfr_print) before 4.9.3 allows remote attackers to cause a denial of service or possibly execute arbitrary code.

Vulnerability

A buffer over-read vulnerability exists in the mfr_print() function in print-fr.c of tcpdump, specifically in the FRF.16 (Frame Relay Fragmentation) parser. This flaw affects tcpdump versions prior to 4.9.3. The over-read occurs when processing malformed FRF.16 frames, leading to reading beyond the allocated buffer boundaries [2][3].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted network packet to a system running a vulnerable version of tcpdump. When tcpdump captures and parses the malicious FRF.16 frame, the mfr_print() function performs an out-of-bounds read. No special privileges or user interaction is required beyond the victim running tcpdump in capture mode [2][3].

Impact

Successful exploitation could cause tcpdump to crash, resulting in a denial of service. The Ubuntu security advisory notes that this vulnerability could also potentially allow arbitrary code execution, depending on the memory layout and attacker control over the over-read data [2][3].

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3. Users should upgrade to this version or later. Ubuntu has released updated packages in USN-4252-1 and USN-4252-2 for various releases [2][3]. No workarounds are available; updating tcpdump is the recommended mitigation.

References
  1. USN-4252-2: tcpdump vulnerabilities | Ubuntu security notices | Ubuntu
  2. USN-4252-1: tcpdump vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

11

Patches

2
d9a693b04326

VERSION set for release

https://github.com/the-tcpdump-group/tcpdumpMichael RichardsonSep 30, 2019via osv
commit
1 file changed · +1 −1
  • VERSION+1 −1 modified
    @@ -1 +1 @@
-4.9.3rc2
+4.9.3
aa3e54f59438

(for 4.9.3) CVE-2018-14468/FRF.16: Add a missing length check.

https://github.com/the-tcpdump-group/tcpdumpDenis OvsienkoSep 1, 2017via osv
commit
4 files changed · +8 −0
  • print-fr.c+5 −0 modified
    @@ -493,6 +493,11 @@ mfr_print(netdissect_options *ndo,
             switch (ie_type) {
 
             case MFR_CTRL_IE_MAGIC_NUM:
+                /* FRF.16.1 Section 3.4.3 Magic Number Information Element */
+                if (ie_len != 4) {
+                    ND_PRINT((ndo, "(invalid length)"));
+                    break;
+                }
                 ND_PRINT((ndo, "0x%08x", EXTRACT_32BITS(tptr)));
                 break;
  • tests/frf16_magic_ie-oobr.out+2 −0 added
    @@ -0,0 +1,2 @@
+FRF.16 Control, Flags [Begin, End, Control], Unknown Message (0x00), length 3714318497
+	IE Magic Number (3), length 3: (invalid length)[|mfr]
  • tests/frf16_magic_ie-oobr.pcap+0 −0 added
  • tests/TESTLIST+1 −0 modified
    @@ -572,6 +572,7 @@ olsr-oobr-2		olsr-oobr-2.pcap		olsr-oobr-2.out	-v
 ikev1_id_ipv6_addr_subnet-oobr	ikev1_id_ipv6_addr_subnet-oobr.pcap	ikev1_id_ipv6_addr_subnet-oobr.out	-v
 isakmp-various-oobr	isakmp-various-oobr.pcap	isakmp-various-oobr.out	-v
 aoe-oobr-1		aoe-oobr-1.pcap			aoe-oobr-1.out	-v -c1
+frf16_magic_ie-oobr	frf16_magic_ie-oobr.pcap	frf16_magic_ie-oobr.out	-v -c1
 
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

17

News mentions

0

No linked articles in our index yet.